Reply to thread

Message

<blockquote data-quote="South Park" data-source="post: 1106123" data-attributes="member: 73194">The only thing I had installed recently was a digitally signed font (Newsreader) with SHA-256 of 8a08d13f8a6c0d51be379a60af84f945f65369a67e509ee3c3bdcc421254d7c1 and 796668611f80b64d5adf182fde3b6f29ed83b4e7cbec7b96937e84ac01364792 (both OK on Virus Total). I ran the offline Defender scan which reported nothing. I uninstalled the font anyway but am still getting this message:[ICODE]Event[0]:Time Created&nbsp; : 10/26/2024 1:08:22 PMProviderName : Microsoft-Windows-Windows DefenderId&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; : 1121Message&nbsp; &nbsp; &nbsp; : Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; For more information please contact your IT administrator.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ConfigureDefender option: Block credential stealing from the Windows local security authority subsystem (lsass.exe)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Detection time: 2024-10-26T20:08:22.542Z&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User: NT AUTHORITY\SYSTEM&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Path: C:\Windows\System32\svchost.exe&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Process Name: C:\Windows\System32\lsass.exe&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Target Commandline:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Parent Commandline:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Involved File:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Inheritance Flags: 0x00000000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Security intelligence Version: 1.419.722.0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Engine Version: 1.1.24080.9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Product Version: 4.18.24080.9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [/ICODE]</blockquote>

[QUOTE="South Park, post: 1106123, member: 73194"] The only thing I had installed recently was a digitally signed font (Newsreader) with SHA-256 of 8a08d13f8a6c0d51be379a60af84f945f65369a67e509ee3c3bdcc421254d7c1 and 796668611f80b64d5adf182fde3b6f29ed83b4e7cbec7b96937e84ac01364792 (both OK on Virus Total). I ran the offline Defender scan which reported nothing. I uninstalled the font anyway but am still getting this message:[ICODE] Event[0]: Time Created : 10/26/2024 1:08:22 PM ProviderName : Microsoft-Windows-Windows Defender Id : 1121 Message : Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator. For more information please contact your IT administrator. ID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 ConfigureDefender option: Block credential stealing from the Windows local security authority subsystem (lsass.exe) Detection time: 2024-10-26T20:08:22.542Z User: NT AUTHORITY\SYSTEM Path: C:\Windows\System32\svchost.exe Process Name: C:\Windows\System32\lsass.exe Target Commandline: Parent Commandline: Involved File: Inheritance Flags: 0x00000000 Security intelligence Version: 1.419.722.0 Engine Version: 1.1.24080.9 Product Version: 4.18.24080.9 [/ICODE] [/QUOTE]

Verification